Evaluation of DNS pre-registration data to predict future DNS traffic

ABSTRACT

Methods and systems analyze historical NXD traffic to predict future DNS traffic. In one embodiment, a system may count NXD responses generated by an Authoritative DNS server during a particular time period and calculate the variance in NXD traffic for domains over time. The system may then generate a coefficient of variance (CoV) value for each domain observed. Finally, the system may predict positive domain traffic based upon the calculated CoV data. In other embodiments, the system may also base the prediction on the classification of domains as “original” domains or “re-registered” domains. In another embodiment, the system may also base the prediction on the “size” of name servers. Additionally, or alternatively, the system may determine the number of unique name servers for a domain and base the prediction on the number of unique name servers for a particular domain name.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a divisional of U.S. application Ser. No.13/171,584, filed on Jun. 29, 2011 that claims priority from U.S.provisional application No. 61/407,642, filed Oct. 28, 2010, U.S.provisional application No. 61/407,632, filed Oct. 28, 2010, U.S.provisional application No. 61/407,636, filed Oct. 28, 2010, and U.S.provisional application No. 61/407,638, filed Oct. 28, 2010. Eachpreviously filed application is hereby incorporated by reference intheir entirety.

FIELD OF THE INVENTION

The present disclosure relates generally to methods and systems foranalyzing historical NXD traffic to predict future DNS traffic.

BACKGROUND OF THE INVENTION

The Internet enables a user of a client computer system to identify andcommunicate with millions of other computer systems located around theworld. A client computer system can identify each of these othercomputer systems using a unique numeric identifier for that computercalled an “IP address.” When a communication is sent from a clientcomputer system to a destination computer system, the client computersystem typically specifies the IP address of the destination computersystem in order to facilitate the routing of the communication to thedestination computer system. For example, when a request for a WorldWide Web page (“Web page”) is sent from a client computer system to aWeb server computer system (“Web server”) from which that Web page canbe obtained, the client computer system typically includes the IPaddress of the Web server.

To make the identification of destination computer systems more easilyusable by humans, a Domain Name System (DNS) has been developed thattranslates a unique alphanumeric name for a destination computer systeminto the IP address for that computer. The alphanumeric name is called a“domain name.” For example, the domain name for a hypothetical computersystem operated by Example Corporation may be “website.example.com”.Using domain names, a user attempting to communicate with this computersystem could specify a destination of “website.example.com” rather thanthe particular IP address of the computer system (e.g., 198.81.209.25).

The domain names in the DNS are structured in a hierarchical,distributed database that facilitates grouping related domain names andcomputers and ensuring the uniqueness of different domain names. Inparticular, as mentioned above, a particular domain name such as“example.com” may identify a specific host computer. However, thehierarchical nature of the DNS also allows a domain name such as“example.com” to represent a domain including multiple other domainnames each identifying computers (also referred to as “hosts”), eitherin addition to or instead of identifying a specific computer.

New domain names can be defined (or “registered”) by various domain nameregistrars. In particular, a company that serves as a registrar for atop-level domain (TLD) such as .com, .net. .us, and the like, can assistcustomers in registering new domain names for that TLD and can performthe necessary actions so that the technical DNS information for thosedomain names is stored in a manner accessible to name servers for thatTLD. Registrars often maintain a second-level domain name within theTLD, and provide an interactive website at their domain name from whichcustomers can register new domain names. A registrar will typicallycharge a customer a fee for registering a new domain name.

For the .com, .net, and .org TLDs, a large number of registrarscurrently exist, and a single shared registry (“the Registry”) under thecontrol of a third-party administrator stores information identifyingthe authoritative name servers for the second-level domain names inthose TLDs. Other TLDs may have only a single registrar, and if so thatregistrar may maintain a registry for all the second-level domains inthat TLD by merely storing the appropriate DNS information for eachdomain name that the registrar registers. In other situations, multipleregistrars may exist for a TLD, but one of the registrars may serve as aprimary registrar that maintains a registry for each of the second-leveldomains in that TLD. If so, the secondary or affiliate registrars forthat TLD supplies the appropriate DNS information for the domain namesthat they register to the primary registrar. Thus, the manner in whichthe DNS information for a TLD is obtained and stored is affected by theregistrars for that TLD.

Users of the aforementioned DNS generally do not communicate directlywith a Root DNS Server. Instead, resolution typically takes placetransparently in applications programs such as web browser and otherInternet applications at the local computer level. When an applicationrequires a domain name lookup, such programs send a resolution requestto the DNS resolver in the local operating system, which in turn handlesthe communications required.

The DNS resolver often has a cache containing recent lookups. If thecache can provide the answer to the request, the resolver will returnthe value in the cache to the program making the request. If the cachedoes not contain the answer (or the information has expired), theresolver will typically send the request through a series of networkdevices to one or more designated DNS servers. In the case of most homeusers, the Internet Service Provider (ISP) to which the machine connectswill supply this DNS server. In any event, the name server thus queriedwill follow the process outlined above until it successfully finds aresult or determines that none is available. It then returns any resultsto the DNS resolver, the resolver caches the result for future use andpasses the result back to the software which initiated the request.

In the case of a domain that is not registered, a corresponding domainresolution request will need to traverse to the level of anAuthoritative Root DNS Server. The Root DNS Server will reply with anauthoritative response of a “non-existent domain”. Requests to resolvesuch non-existent domains are retained in an external repository.NXDomains (or NXD) is a term used for the Internet domain name that isunable to be resolved using the DNS implementation owing either to thedomain name not yet being registered or a server problem. The referenceto the NXDOMAIN is published in RFC 1035 (Domain names—implementationand specification) and also in RFC 2308, both of which are incorporatedherein by reference in their entireties.

For domains that are registered, a domain resolution request handled byan authoritative DNS Server results in a YXDOMAIN (YXD) response. TheYXD response is defined in RFC 2136, which is incorporated by referencein its entirety.

Further information regarding the DNS, including tracking and use of NXDresponses and similar aspects of the DNS, is provided in U.S.application Ser. No. 12/609,831, filed Oct. 30, 2009, U.S. applicationSer. No. 12/859,810, filed Aug. 20, 2010, and U.S. application Ser. No.12/859,820, filed Aug. 20, 2010, the disclosure of each of which isincorporated by reference in its entirety.

SUMMARY OF THE INVENTION

In accordance with disclosed embodiments, potentially valuableNon-Existent Domain (NXD) names may be identified by analyzing, amongother things, Domain Name System (“DNS”) pre-registration data. Suchembodiments allow companies to identify NXDs that exhibit DNS trafficpatterns that are determined to result in higher positive DNS trafficpost-registration.

A tool implementing disclosed embodiments may receive a request foranalysis that identifies one or more domain names. The tool may furthercollect and analyze DNS requests associated with NXDs receiving DNStraffic during an identified time period (including one or more NXDsspecifically identified in a request). The tool may then predictpositive domain traffic for domains based on data generated from thecollected DNS requests. The tool may express predicted DNS traffic inseveral ways, including (i) relative monetization values for domains,(ii) value ratings or classifications for a domain according to abaseline, and/or (iii) traffic statistic predictions for one or moredomains.

In one embodiment, the tool may count the NXD responses generated by anAuthoritative DNS server during a particular time period. The tool maynext calculate the variance in NXD traffic for domains over time. Basedon the variance data, the tool may generate a coefficient of variance(CoV) value for each domain observed. Finally, the tool may predictpositive domain traffic for a domain based upon an analysis of thecalculated CoV data, wherein a domain having a higher CoV is expected tohave less positive domain traffic following registration. The tool mayadditionally, or alternatively, identify a domain as an “original”domain or “re-registered” domain and predict positive domain traffic fora domain based at least in part on the identification. An “original”domain includes domains that have never before been registered.Conversely, a “re-registered” domain was previously registered, but theregistration has since lapsed.

In another embodiment, the tool may determine the size of name serversaccording to the number of NXD requests sent by each name server andpredict positive domain traffic for a domain based on the size of thename server requesting that domain. Additionally, or alternatively, thenumber of unique name servers for a domain may be determined, and thepositive domain traffic for a domain predicted based on the number ofunique name servers for a particular domain name.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts illustrative results from analyses performed consistentwith disclosed embodiments, plotting a CoV series against the respectiveYXD hits received in a month following a domain registration as ameasure of volatility.

FIG. 2 is an illustrative representation of the distribution of CoVvalues for similarity metrics associated with domains whose YXD hitsexceed the group mean and domains whose YXD hits falls below the groupmean, generated according to analyses consistent with disclosedembodiments.

FIG. 3 is an illustrative representation of the distribution of domainsby their calculated CoV value, generated according to analysesconsistent with disclosed embodiments.

FIG. 4 is an illustrative representation of the distribution of domainsreceiving or not receiving click traffic according to their CoV value,generated according to analyses consistent with disclosed embodiments.

FIG. 5 is an illustrative representation of the percentage of Domains ina CoV group receiving click traffic, generated according to analysesconsistent with disclosed embodiments.

FIG. 6 is an illustrative representation of domains plotted againsttheir CoV and subsequent month's YXD scores, generated according toanalyses consistent with disclosed embodiments.

FIG. 7 is an illustrative representation of click traffic received by agroup of domains according to their variances and registrationhistories, generated according to analyses consistent with disclosedembodiments.

FIG. 8 is an illustrative comparison for the average amount of Clicksreceived per domain according to the type of domain, generated accordingto analyses consistent with disclosed embodiments.

FIG. 9 is an illustrative histogram depicting the distribution ofrequesting name servers and number of requests generated by each nameserver grouping daily, generated according to analyses consistent withdisclosed embodiments.

FIG. 10 is an illustrative plotting of domains separated into historicalgroups, CoV values, average size of requesting name servers, and amountof Clicks received, generated according to analyses consistent withdisclosed embodiments.

FIG. 11 depicts the total number of unique name servers in relation toCoV of a domain using analyses consistent with disclosed embodiments.

FIG. 12 depicts the quantitative-based comparisons of results associatedwith performed analyses consistent with disclosed embodiments.

FIG. 13 depicts the percentage-based comparisons of results associatedwith performed analyses consistent with disclosed embodiments.

DESCRIPTION OF THE EMBODIMENTS

It is understood that the invention is not limited to the particularmethodology, protocols, topologies, etc., as described herein, as thesemay vary as the skilled artisan will recognize. It is also to beunderstood that the terminology used herein is used for the purpose ofdescribing particular embodiments only, and is not intended to limit thescope of the invention. It also is to be noted that as used herein andin the appended claims, the singular forms “a,” “an,” and “the” includethe plural reference unless the context clearly dictates otherwise.

Unless defined otherwise, all technical and scientific terms used hereinhave the same meanings as commonly understood by one of ordinary skillin the art to which the invention pertains. The embodiments of theinvention and the various features and advantageous details thereof areexplained more fully with reference to the non-limiting embodimentsand/or illustrated in the accompanying drawings and detailed in thefollowing description. It should be noted that the features illustratedin the drawings are not necessarily drawn to scale, and features of oneembodiment may be employed with other embodiments as the skilled artisanwould recognize, even if not explicitly stated herein.

DNS records, including NXD records, may be used to derive variousinformation about registered, unregistered, and unresolvable domains.Various techniques for doing so are described in U.S. application Ser.Nos. 12/859,810 and 12/859,820, and in Shuang Hao, Nick Feamster, andRamakant Pandranki, An Internet-Wide View into DNS Lookup Patterns. Thelatter paper refers to YXD analysis, but similar techniques may beapplied to NXD records.

It has been found that various techniques for analyzing pre-registrationand other DNS data may be used in conjunction to obtain a range ofinformation about potential domain names before the names are registeredin the DNS. In embodiments of the invention, data based on NXD requestsfrom name servers, historical NXD traffic, and a domain's registrationhistory each may be used in combination with some or all of the othersto obtain a profile of a particular domain name or sets of domain names.

In an embodiment, a technique for evaluating a domain may includeidentifying the domain as an Original Domain or as a Re-registereddomain, receiving non-existent domain (NXD) requests from a plurality ofname servers for the domain over a first period of time, determining thesize of each of the plurality of name servers, the size of a name serverbeing proportional to the total number of NXD requests sent by the nameserver for the specified time period, and calculating the variance inthe NXD responses for the domain over time, as well as the total numberof unique name servers requesting the domain in the specified timeperiod. Based upon at least one of the calculated variance, theidentification of the domain as Original or Re-registered, thedetermined sizes of the plurality of name servers, the total number ofunique name servers requesting the domain during the specified timeperiod, or a combination thereof, it is possible to predict one or moremetrics related to the domain. In an embodiment, the metric includes atleast one of the expected name-in-use (YXD) response level for thedomain, the expected click traffic for the candidate domain relative toat least one other domain, or a combination thereof.

Predicting Future DNS Traffic Based on Historical NXD Traffic

As disclosed herein, NXD lookup patterns may be characterized based uponhow the lookup patterns differ for domains which receive large amountsof YXD traffic immediately after registration versus those domains whichreceive little YXD traffic immediately after registration. It has beenfound that domains with NXD traffic patterns which exhibit smallervariance in their temporal characteristics tend to exhibit a higherlevel of YXD traffic upon registration. This distinct temporalcharacteristic of NXD traffic of unregistered domains suggests it may bepossible to predict and quantify the amount of YXD traffic for a domaingiven its NXD traffic, using the domain's historical traffic records.This may provide an indication of the domain's expected value, clicktraffic rate, and other measures.

In an embodiment, a domain tracking system may count NXD responsesgenerated by an authoritative name server for a domain during a periodof time, calculate the variance in NXD responses over time, and, basedupon the variance, predict the expected YXD response level and/or clicktraffic. In some embodiments, the variance in NXD responses over time iscalculated using the IP addresses of the requesting name servers. Thevariance, expected YXD traffic, and/or the expected click traffic may beused to rate or value the domain. Typically, domains with higher YXDtraffic and/or higher click traffic are rated higher or considered morevaluable than domains with lower YXD and/or click traffic.

In an embodiment, a system may count NXD responses for a set of domainsduring a period of time and calculate the variance in NXD responsesduring this time. The calculated variance may then be used to assignexpected YXD and/or click traffic levels to the domains, with a highervariance indicating a lower traffic level. The domains may be ranked bythe expected traffic level or levels, and each domain's relative rankmay be used to determine an expected value or other rating. These ranksand/or the associated valuation may be provided to a purchaser seekingto register one or more domains.

The domain tracking, analysis, registration, and other functionsdescribed herein may be performed by a domain registrar, registry,Internet Service Provider (ISP) or any associated or similar system.Typically, NXD and YXD traffic may be collected by any name server,especially authoritative name servers for a particular domain. Themetrics and ranking described herein may be performed by the registraror registry system, or by a system in communication with the registrarand/or registry.

Experimental Data

A set of 643 domains was selected, and YXD measurements for all of thesedomains during a month were collected. These YXD scores were used in thecorrelation of the NXD Jaccard Index and Co variance measurements.

Temporal Behavior Analysis

On any given day, the IP addresses that query a particular domain can beexpressed as a set. By examining sets of IP addresses on a daily basis,it can be determined how the set of name servers that queried aparticular domain evolved over time. This analysis makes use of theJaccard index to measure the similarity of these sets over time.

In an example of such analysis, daily NXD records over a month weregrouped into daily sets of IP addresses using a/24 subnet. The Jaccardindex from Day (X) to Day (X+1) was calculated for the specified timeperiod. The average of these index values, as well as the standarddeviation was calculated for each domain. Using the standard deviationand mean Jaccard index, each domain's coefficient of variance (CoV) wasthen calculated. This statistical measurement presents a measure ofvolatility. By plotting the results of the CoV series against therespective YXD hits received in the subsequent month after the domainwas registered, it was found that the data exhibit a direct correlationbetween the YXD traffic and the domain's prior month's CoV measurement.These results are shown in FIG. 1.

Next, the domains were separated into two groups by partitioning thedomains into a group of domains whose average YXD hits exceeded thegroup's average and a group of domains whose average YXD hits were lessthan the average. The mean YXD hits for all domains was calculated andany domain receiving more than the mean was placed into the high groupand those receiving below the mean were placed into the low group. Toshow the variability of the Jaccard index between the high and lowgroups, the CoV values were plotted as the distribution of CoVs for bothgroups. FIG. 2 shows the distribution of the CoV for similarity metricsof the two groups. A larger CoV indicates more “churn” from one day tothe next. As shown in FIG. 2, it was found that the “high YXD” groupgenerally exhibits less churn in the similarity metric, while the “lowYXD” group exhibits higher levels of churn.

These data indicate that the correlation between the CoV within NXDtraffic prior to a domain's registration can be utilized as a reliablemetric for predicting YXD traffic after registration.

Click traffic reported for a particular month can also be analyzed usingthe CoV measurements described above. As used herein, a “click” refersto a monetization event (i.e. a conversion) that occurs when a user“clicks” on an advertisement displayed on a domain's website; “clicktraffic” is the resulting network traffic.

Click Traffic and the Coefficient of Variance

As described above, a set of domains received a varied amount of YXDtraffic as well as click traffic. The domains used within this study maybe grouped to demonstrate the distribution of domains under this new CoVmetric. It was found that approximately 73% of the domains received CoVvalues equal or higher to 3. Those domains would be categorized into thelow group of YXD traffic receivers. FIG. 3 shows the distribution ofdomains by CoV.

Using the click traffic received by each domain in a particular month,the set of domains was partitioned into two groups: those receivinggreater than zero click traffic, and those receiving no click traffic.The distribution of these two groups under the new CoV metric is shownin FIG. 4.

FIG. 5 shows values for the percentage of each CoV group receiving clicktraffic, i.e., <number of domains receiving click traffic>/<total numberof domains in each group>. FIG. 5 illustrates that the number of domainsin groups having lower CoV values generally receive more click traffic.This indicates that the CoV metrics for domains may be more reliablemetrics for determining whether a NXDomain is more or less likely toreceive immediate YXD and/or click traffic once it is registered.

Domain Registration History

As disclosed herein, it has been found that the registration history ofa domain may be used to predict future YXD traffic, click traffic,and/or other use of the domain. Domains can be logically divided intotwo distinct categories: Original Domains and Reregistered Domains. Asused herein, an “Original Domain” is a domain that has never beenregistered at any point during a TLD's registration history. A“Reregistered Domain” refers to a domain name that was once registered,subsequently was deleted from the registry, and has again becomeavailable for registration.

Upon registration of a domain, documents detailing it (zone files,Whois, etc.) are published by the registrar and/or the registry. As aresult, Internet agents such as bots, spiders, spammers, etc. can becomeaware of the new domain and begin to issue DNS queries to resolve thedomain. Such agents, which also may be referred to as web robots, WWWrobots or simply “bots”, are software applications that run automatedtasks over the Internet. Typically, bots perform tasks that are bothsimple and structurally repetitive, at a much higher rate than would bepossible for a human alone. One of the largest uses of bots is in webspidering, in which an automated script fetches, analyzes and filesinformation from web servers at many times the speed that might bemanually implemented by a human. In the context of issued DNS queries,if a domain expires or becomes available for reregistration, Internetagents may continue to issue DNS queries for that domain and accordinglyproduce NXD traffic responses. These queries may pollute or skew NXDdata, especially when the data is analyzed to determine the relativetraffic to the domain, or traffic that may be expected if the domain isreregistered. NXD traffic responses may also be caused for numerousother reasons including bookmarks to deleted domains, DNSmisconfigurations, etc. These types of pollution make the analysis ofReregistered Domains more challenging.

It has been found that an Original Domain and its associated NXD trafficcan be viewed as a “pure” form of “type-in traffic,” i.e., trafficresulting from an explicit user request such as where the user types thedomain into a web browser address bar. Because the domain has never beenregistered, automated Internet agents are unable to cause NXD pollutionunless they utilize some brute-force approach or create an unintentionalpolluting resource, such as an email containing a bad link. Therefore,NXD requests for Original Domains can be presumed to be human generated,and an Original Domain's NXD traffic should provide an indication of theamount of demand for that particular domain at a relatively highconfidence level. Accordingly, it would be expected that this demand tobe reflected in the amount of click traffic received post-registration.

In an embodiment, a domain tracking system may identify domains asOriginal or Reregistered and, based upon the classification, project theexpected click, YXD, or other traffic for the domain. The projectionsmay be made relative to one or more other domains. The system also maycalculate a coefficient of variance of NXD requests for the domain, anduse this variance to further refine the projected traffic level orlevels. This data may be provided to potential registrants, and/or usedto valuate the domain.

In an embodiment, a tracking system may classify each domain in a set ofdomains as Original or Reregistered, and/or calculate the variance inNXD data for each domain. The classification and/or NXD variance may beused to determine the expected click traffic for the domains, where ahigher variance indicates a lower expected traffic level. The expectedtraffic may be determined relatively for each domain, and may beprovided to potential registrants, for example as part of a valuation orranking of the domain.

Experimental Data

A set of 643 domains was selected, and YXD measurements for all of thesedomains during a month were collected. These YXD scores were used in thecorrelation of the NXD Jaccard Index and Covariance measurements.

Registration History Analysis

A Jaccard index was calculated to measure the amount of overlap ofrequesting IP addresses that queried a particular domain from one day tothe next. Using the average of these index values and their standarddeviation, each domain's Coefficient of Variance (CoV) was calculated,which provides a measure of the domain's volatility. These twocalculated metrics were used in conjunction with YXD and click trafficmeasurements for the domains.

FIG. 6 shows the 643 domains (including 245 Original and 398Reregistered) plotted against their CoV and subsequent month's YXDscores. The chart also illustrates each domain's click traffic as abubble having a size proportional to the number of clicks received bythe domain, with larger bubbles representing more click traffic. Thedomains were also separated into four groups: Original with Clicks,Original without Clicks, Reregistered with Clicks, and Reregisteredwithout Clicks. Any domain receiving one or more Clicks was placed in agroup with Clicks, while domains receiving zero Clicks were placed inthe without Clicks groups.

The chart in FIG. 6 suggests several generalizations about the observeddomains. Domains exhibiting smaller CoV values tend to be the recipientsof larger YXD requests post-registration. Domains with larger YXD valuesalso tend to receive more Click traffic. Original domains with Clicksare also found to be the primary receivers of Click traffic.Reregistered domains with Clicks are more sparse and do not account fora large percentage of domains receiving Click traffic.

Comparison of Click Rates for Original and Reregistered Domains

The influence of a domain's history on subsequent traffic for the domainmay be further developed by comparing the amount of Clicks received byboth Original and Reregistered domains. FIG. 7 shows click trafficreceived by the domains according to their variances and registrationhistories. The left column illustrates a Click comparison of all 643domains separated into groups of Original and Reregistered.

The set of domains received a total of 1536 Clicks, of which 1180 or 77%were attributed to Original domains. This suggests that the primaryrecipients of Clicks are Original domains, while Reregistered domains donot receive a significant relative portion of Click traffic.

As disclosed herein, domains with smaller CoV values tend to exhibitlarger amounts of YXD traffic and accordingly receive more Clicktraffic. Therefore, by only measuring the domains under a CoV value of3, the effect of filtering domains by their CoV value and observe theClick quantities of Original and Reregistered domains within this subsetof domains may be observed.

The column on the right of FIG. 7 depicts this filtering technique. Theamount of Clicks received is 1028 or 67% of the initial set. However,the total number of domains measured at a level of under CoV 3 isreduced to 11% of the initial group (69 versus 643). This suggests thatthe CoV can provide a strong metric for measurement of filtering orranking domains for the purpose of click traffic measurement. This canbe used, for example, to predict relative monetization values based onclick traffic. It also demonstrates the relative importance of adomain's history as Original Domains significantly outperformReregistered Domains (868 Original clicks versus 160 Reregisteredclicks).

In another approach, the impact of a domain's registration history canbe measured by comparing the average amount of Clicks received perdomain and by the type of domain (Original or Reregistered). FIG. 7shows a comparison of the initial 643 domain set separated by a domain'shistory.

To establish a baseline metric, the center column of the graph in FIG. 8shows the average number of clicks for the entire initial 643 domain setto be 2.8 Clicks/domain. The two columns on the left shows the averageclick rate after separating this initial set of domains into groups ofOriginal and Reregistered. It was found that the Original (NewRegistration) Domains have higher average click traffic thanReregistered (Previously Registered) domains at a 4.6 Clicks/domain rateversus that of a 0.79 Clicks/domain rate.

Filtering domains by their CoV level has been found to reduce the numberof domains purchased yet still retain a high percentage of the initialClick traffic. A filter can be applied to the initial domain set to seethe effect of average Clicks/domain. The two columns on the right of thegraph in FIG. 8 show domains grouped by their domain history afterfiltering and have a CoV level below 3. Again, it was found that theOriginal Domains have a noticeably higher traffic rate than theReregistered Domains, with a Click/domain rate of 12.2 versus that of0.58 Click/domain.

It has been found that a domain's registration history can provide areliable indication of expected click traffic for the domain. Thiscorrespondence can be used, for example, to value the domain for clickmonetization or other uses.

Profiling Domains Based on NXD Requests

As disclosed herein, data regarding and derived from the distributionand makeup of name servers from which NXD data is received may allow forunderstanding the associated NXD traffic patterns. FIG. 9 shows ahistogram of the distribution name servers from which requests typicallyare received, and the number of requests generated by each name serverdaily. This graph follows a power law distribution, in which there aremany name servers generating very few NXD requests and very few nameservers generating a majority of the requests. As an example, VeriSignInc. receives NXD data from roughly 1.2 million unique name servers onan average day.

In an embodiment, NXD requests may be received from a plurality of nameservers for a domain over a first period of time, and the size of eachof the plurality of name servers determined, where the size of a nameserver being proportional to the total number of NXD requests sent bythe name server. Based upon the determined sizes, the expected clicktraffic for the domain may be predicted.

In an embodiment, a method of evaluating a domain includes receiving NXDrequests from a plurality of name servers for a domain over a firstperiod of time, determining the number of unique name servers sendingthe requests, and based upon the determined number of unique nameservers, predicting the expected click traffic for the domain.

In an embodiment, a method of evaluating a domain includes receiving NXDrequests from a plurality of name servers for a domain over a firstperiod of time, determining the size of each of the plurality of nameservers, the size of a name server being proportional to the totalnumber of NXD requests sent by the name server, determining the numberof unique name servers sending the requests, and based upon thedetermined sizes and the determined number of unique name servers forthe domain, predicting the expected click traffic for the domain.

Experimental Data

A set of 643 domains was selected, and NXD measurements for all of thesedomains during a month were collected. These NXD scores were used inconjunction with name server profiling and classification data, wereused to examine correlations between click traffic receivedpost-registration of a domain and the size and number of requesting nameservers

Name Server Size

FIG. 10 shows an example plot of the set of domains separated into theirhistorical groups, CoV values, average size of their requesting nameservers, and the amount of Clicks received (shown proportionally asbubbles). The average name server size is calculated by retrieving alist of all name servers that requested a domain, counting the totalnumber of NXD requests sent by each of the name servers, and averagingthe sums for each name server.

FIG. 10 shows the relationship between the size of name serversrequesting a particular domain and the domain's Click traffic. Domainsreceiving traffic from high volume name servers generally receive littleto no Click traffic, while domains receiving traffic from low volumename servers are the primary recipients of Click traffic. As disclosedearlier with respect to the global distribution of name servers, thiscorrelation may suggest that high volume NXD name servers tend to beassociated with Internet services such as email or spiders/agents, whilelow volume name servers are associated with human-driven activity. Thiswould suggest that NXD requests may be considered as an abnormality inInternet traffic and, accordingly, name servers that exhibit relativelyexcessive amounts of NXD traffic typically do not reflect human-drivenresolution activity.

Number of Unique Name Servers

FIG. 11 depicts the total number of unique name servers (/24), ratherthan the average name server size for the set of domains, with theamount of Clicks received (shown proportionally as bubbles). It wasfound that domains are requested from a wider audience of name serverstend to be the recipients of Click traffic. This suggests that domainsmay be rated based on their YXD data, and that the total number ofunique name servers receiving requests for each domain may provide anaccurate metric to evaluate the perceived demand for a given domain.

Evaluating Name Server Metrics and Clicks

As disclosed herein, metrics such as CoV, registration history and nameserver profiling may allow for identification of domains that typicallyreceive Click traffic, or that are relatively more likely to receiveClick traffic than other domains. It also may be useful to understandhow these metrics, when applied to a set of domains, may affect thenumber of domains purchased by a registrant or group of registrants, aswell as the amount of Click traffic received. FIGS. 12-13 showquantitative and percentage-based comparisons of applying differentfiltering techniques of these newly discovered metrics.

The original data set included 643 domains and a total of 1383 Clicks.When a basic filtering technique of only purchasing domains under a CoVvalue of 4 and domains whose average name server size was under 60K isapplied to the original data set, the number of domains purchased isreduced to 209. However, it was found that the number of Clicks receivedremained relatively high at 1298 (32.5% of the original amount ofdomains and 93.85% of the original amount of Clicks, as shown).Additional combinations of these new NXD-to-Click metrics were used asfiltering techniques and their results are plotted in FIG. 13.

It has been found that using these metrics to identify potential domainsfor Click monetization provides measureable improvement overpreviously-known techniques of evaluating NXDomains.

An embodiment of the invention may be embodied in the form ofcomputer-implemented processes and apparatuses for practicing thoseprocesses. Embodiments also may be embodied in the form of a computerprogram product having computer program code containing instructionsembodied in tangible media, such as floppy diskettes, CD-ROMs, harddrives, USB (universal serial bus) drives, or any other machine readablestorage medium, wherein, when the computer program code is loaded intoand executed by a computer, the computer becomes an apparatus forpracticing the invention. Embodiments of the invention also may beembodied in the form of computer program code, for example, whetherstored in a storage medium, loaded into and/or executed by a computer,or transmitted over some transmission medium, such as over electricalwiring or cabling, through fiber optics, or via electromagneticradiation, wherein when the computer program code is loaded into andexecuted by a computer, the computer becomes an apparatus for practicingthe invention. When implemented on a general-purpose microprocessor, thecomputer program code segments configure the microprocessor to createspecific logic circuits. In some configurations, a set ofcomputer-readable instructions stored on a computer-readable storagemedium may be implemented by a general-purpose processor, which maytransform the general-purpose processor or a device containing thegeneral-purpose processor into a special-purpose device configured toimplement or carry out the instructions.

Examples provided herein are merely illustrative and are not meant to bean exhaustive list of all possible embodiments, applications, ormodifications of the invention. Thus, various modifications andvariations of the described methods and systems of the invention will beapparent to those skilled in the art without departing from the scopeand spirit of the invention. Although the invention has been describedin connection with specific embodiments, it should be understood thatthe invention as claimed should not be unduly limited to such specificembodiments. Indeed, various modifications of the described modes forcarrying out the invention which are obvious to those skilled in therelevant arts or fields are intended to be within the scope of theappended claims.

What is claimed is:
 1. A method for predicting future network traffic,comprising: receiving non-existent domain (NXD) requests from aplurality of name servers for one or more candidate domains over a firstperiod of time; determining a total number of NXD requests sent by eachof the plurality of name servers over the first period of time;determining the size of each of the plurality of name servers based onthe determined total number of NXD requests sent by each name serverover the first period of time; and based on at least the determined sizeof each of the plurality of name servers, predicting at least one of anexpected name-in-use response level for the one or more candidatedomains, an expected click traffic for the one or more candidatedomains, or a combination thereof.
 2. The method of claim 1, furthercomprising: providing an indication to a purchaser of the expectedname-in-use response level for the one or more candidate domains,expected click traffic for the one or more candidate domains, or acombination thereof.
 3. The method of claim 2, wherein the indicationcomprises at least one of a relative monetization value for the one ormore candidate domains, a value rating for the one or more candidatedomains according to a predetermined baseline, or a predicted trafficstatistic for the one or more candidate domains.
 4. The method of claim1, further comprising: identifying one or more identified domains fromthe one or more candidate domains receiving traffic from name servers ofbelow a predetermined size; wherein the predicting is further based onwhether the one or more candidate domains are identified as anidentified domain.
 5. The method of claim 1, further comprising:determining a number of unique name servers for the one or morecandidate domains over the first period of time; wherein the predictingis further based on the determined number of unique name servers.
 6. Themethod of claim 1, further comprising: filtering the one more candidatedomains to remove one or more domains receiving traffic from nameservers of above a predetermined size; and making the predictions onlyfor the remaining one or more candidate domains.
 7. A device forpredicting future network traffic, comprising: a memory containinginstructions; and at least one processor, operably connected to thememory, that executes the instructions to perform a method comprising:receiving non-existent domain (NXD) requests from a plurality of nameservers for one or more candidate domains over a first period of time;determining a total number of NXD requests sent by each of the pluralityof name servers over the first period of time; determining the size ofeach of the plurality of name servers based on the determined totalnumber of NXD requests sent by each name server over the first period oftime; and based on at least the determined size of each of the pluralityof name servers, predicting at least one of an expected name-in-useresponse level for the one or more candidate domains, an expected clicktraffic for the one or more candidate domains, or a combination thereof.8. The device of claim 7, wherein the at least one process is furtheroperation to perform the method comprising: providing an indication to apurchaser of the expected name-in-use response level for the one or morecandidate domains, expected click traffic for the one or more candidatedomains, or a combination thereof.
 9. The device of claim 8, wherein theindication comprises at least one of a relative monetization value forthe one or more candidate domains, a value rating for the one or morecandidate domains according to a predetermined baseline, or a predictedtraffic statistic for the one or more candidate domains.
 10. The deviceof claim 7, wherein the at least one processor is further operable toexecute the method comprising: identifying one or more identifieddomains from the one or more candidate domains receiving traffic fromname servers of below a predetermined size; and wherein the predictingis further based on whether the one or more candidate domains areidentified as an identified domain.
 11. The device of claim 7, whereinthe at least one processor is further operable to execute the methodcomprising: determining a number of unique name servers for the one ormore candidate domains over the first period of time; wherein thepredicting is further based on the determined number of unique nameservers.
 12. The device of claim 7, wherein the at least one processoris further operable to execute the method comprising: filtering the oneor more candidate domains to remove one or more domains receivingtraffic from name servers of above a predetermined size; and making thepredictions only for the remaining one or more candidate domains.
 13. Anon-transitory computer readable storage medium comprising instructionsfor causing one or more processors to perform a method, the method forpredicting future network traffic, comprising: receiving non-existentdomain (NXD) requests from a plurality of name servers for one or morecandidate domains over a first period of time; determining a totalnumber of NXD requests sent by each of the plurality of name serversover the first period of time; determining the size of each of theplurality of name servers based on the determined total number of NXDrequests sent by each name server over the first period of time; andbased on at least the determined size of each of the plurality of nameservers, predicting at least one of an expected name-in-use responselevel for the one or more candidate domains, an expected click trafficfor the one or more candidate domains, or a combination thereof.
 14. Thenon-transitory computer readable storage medium of claim 13, furthercomprising: providing an indication to a purchaser of the expectedname-in-use response level for the one or more candidate domains,expected click traffic for the one or more candidate domains, or acombination thereof.
 15. The non-transitory computer readable storagemedium of claim 14, wherein the indication comprises at least one of arelative monetization value for the one or more candidate domains, avalue rating for the one or more candidate domains according to apredetermined baseline, or a predicted traffic statistic for the one ormore candidate domains.
 16. The non-transitory computer readable storagemedium of claim 13, further comprising: identifying one or moreidentified domains from the one or more candidate domains receivingtraffic from name servers of below a predetermined size; wherein thepredicting is further based on whether the one or more candidate domainsare identified as an identified domain.
 17. The non-transitory computerreadable storage medium of claim 13, further comprising: determining anumber of unique name servers for the one or more candidate domains overthe first period of time; and wherein the predicting is further based onthe determined number of unique name servers.
 18. The non-transitorycomputer readable storage medium of claim 13, further comprising:filtering the one more candidate domains to remove one or more domainsreceiving traffic from name servers of above a predetermined size; andmaking the predictions only for the remaining one or more candidatedomains.
 19. A method for predicting future network traffic, comprising:receiving non-existent domain (NXD) requests from a plurality of nameservers for one or more candidate domains over a first period of time;determining a total number of NXD requests sent by each of the pluralityof name servers over the first period of time; determining the size ofeach of the plurality of name servers-based on the determined totalnumber of NXD requests sent by each name server over the first period oftime; identifying each of the one or more candidate domains as anOriginal Domain or as a Re-registered domain, wherein the Re-registereddomain is a domain that was previously registered but the registrationhas since lapsed; and based on at least the determined size of each ofthe plurality of name servers, the identification, and received NXDrequests, predicting at least one of expected name-in-use responselevels for the one or more candidate domains, expected click traffic forthe one or more candidate domains, or a combination thereof.
 20. Themethod of claim 19, further comprising: providing an indication to apurchaser of the expected name-in-use response level for the one or morecandidate domains, expected click traffic for the one or more candidatedomains, or a combination thereof.
 21. The method of claim 20, whereinthe indication comprises at least one of a relative monetization valuefor the one or more candidate domains, a value rating for the one ormore candidate domains according to a predetermined baseline, or apredicted traffic statistic for the one or more candidate domains. 22.The method of 19, further comprising: determining whether the receivedNXD requests for Re-registered domains are associated withmachine-generated internet activity; filtering the received NXD requeststo remove NXD requests associated with machine-generated internetactivity for Re-registered domains; and making the prediction based onat least the identification and filtered NXD requests.
 23. A device forpredicting future network traffic, comprising: a memory containinginstructions; and at least one processor, operably connected to thememory, that executes the instructions to perform a method comprising:receiving non-existent domain (NXD) requests from a plurality of nameservers for one or more candidate domains over a first period of time;determining a total number of NXD requests sent by each of the pluralityof name servers over the first period of time; determining the size ofeach of the plurality of name servers-based on the determined totalnumber of NXD requests sent by each name server over the first period oftime; identifying each of the one or more candidate domains as anOriginal Domain or as a Re-registered domain, wherein the Re-registereddomain is a domain that was previously registered but the registrationhas since lapsed; and based on at least the determined size of each ofthe plurality of name servers, the identification, and received NXDrequests, predicting at least one of expected name-in-use responselevels for the one or more candidate domains, expected click traffic forthe one or more candidate domains, or a combination thereof.
 24. Thedevice of claim 23, wherein the at least one processor is furtheroperable to execute the method comprising: providing an indication to apurchaser of the expected name-in-use response level for the one or morecandidate domains, expected click traffic for the one or more candidatedomains, or a combination thereof.
 25. The device of claim 24, whereinthe indication comprises at least one of a relative monetization valuefor the one or more candidate domains, a value rating for the one ormore candidate domains according to a predetermined baseline, or apredicted traffic statistic for the one or more candidate domains. 26.The device of 23, wherein the at least one processor is further operableto execute the method comprising: determining whether the received NXDrequests for Re-registered domains are associated with machine-generatedinternet activity; filtering the received NXD requests to remove NXDrequests associated with machine-generated internet activity forRe-registered domains; and making the prediction based on at least theidentification and filtered NXD requests.
 27. A non-transitory computerreadable storage medium comprising instructions for causing one or moreprocessors to perform a method, the method for predicting future networktraffic, comprising: receiving non-existent domain (NXD) requests from aplurality of name servers for one or more candidate domains over a firstperiod of time; determining a total number of NXD requests sent by eachof the plurality of name servers over the first period of time;determining the size of each of the plurality of name servers-based onthe determined total number of NXD requests sent by each name serverover the first period of time; identifying each of the one or morecandidate domains as an Original Domain or as a Re-registered domain,wherein the Re-registered domain is a domain that was previouslyregistered but the registration has since lapsed; and based on at leastthe determined size of each of the plurality of name servers, theidentification, and received NXD requests, predicting at least one ofexpected name-in-use response levels for the one or more candidatedomains, expected click traffic for the one or more candidate domains,or a combination thereof.
 28. The non-transitory computer readablestorage medium of claim 27, further comprising: providing an indicationto a purchaser of the expected name-in-use response level for the one ormore candidate domains, expected click traffic for the one or morecandidate domains, or a combination thereof.
 29. The non-transitorycomputer readable storage medium of claim 28, wherein the indicationcomprises at least one of a relative monetization value for the one ormore candidate domains, a value rating for the one or more candidatedomains according to a predetermined baseline, or a predicted trafficstatistic for the one or more candidate domains.
 30. The non-transitorycomputer readable storage medium of 27, further comprising: determiningwhether the received NXD requests for Re-registered domains areassociated with machine-generated internet activity; filtering thereceived NXD requests to remove NXD requests associated withmachine-generated internet activity for Re-registered domains; andmaking the prediction based on at least the identification and filteredNXD requests.